CVE-2021-41770: Pingidentity Pingfederate

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.

Affected products

• Pingidentity Pingfederate: before 10.3.1 (fixed in 10.3.1)

Published 2021-10-07. Last modified 2026-06-17.